In this article 7 sections
An evidence library is a single, current, organised set of proof that backs every claim your MSP makes in a sales conversation. It is the difference between saying “we take security seriously” and showing a dated report that proves it. MSPs that have one win more competitive deals because the prospect can verify the promise instead of taking it on faith.
Why does an MSP need an evidence library now?
Because winning new clients is now the hardest part of running an MSP. According to Kaseya’s 2026 State of the MSP report, which surveyed 1,061 MSPs in November 2025, 71% of MSPs say acquiring new customers is their single biggest business issue, ahead of cybersecurity, revenue and profitability. Kaseya’s own summary line: winning new business now depends on proving value, not just offering more services.
Every MSP says they are responsive, secure and ahead of problems. The prospect has heard it from the last three providers who pitched them. Evidence is what separates you from the script. It helps after the sale too: the same Kaseya report found the share of MSPs struggling to demonstrate value to existing clients nearly doubled year-on-year, from 10% to 19%.
What goes in an evidence library?
Six categories. Each one answers a question a prospect has no way to check today.
- Security posture: current patch coverage, MFA enforcement, endpoint protection status, backup test results. Dated.
- Independent verification: third-party assessment or trustmark status that confirms your controls are met now.
- Service performance: SLA attainment, ticket resolution times, first-response times, trend over the last 12 months.
- Outcomes for similar clients: anonymised before-and-after on risk reduced, downtime avoided, audits passed.
- Process proof: onboarding runbook, incident response plan, change control, and evidence each is followed.
- References and named quotes: only verbatim, only with sign-off, matched to the prospect’s sector and size.
How do you structure it so it works in a live deal?
The library fails the moment a salesperson has to dig for the right artefact while a prospect waits. Structure it by the question the prospect is asking.
| Evidence type | Prospect question it answers | Refresh cadence |
|---|---|---|
| Security posture report | “How do I know you are actually secure?” | Monthly |
| Independent trustmark status | “Who else verifies this?” | Live-measured controls every six hours, the rest on a set cycle |
| SLA and ticket performance | “Will you actually respond?” | Quarterly |
| Anonymised outcomes | “Has this worked for someone like me?” | Per case, reviewed quarterly |
| Process runbooks | “What happens when something breaks?” | Reviewed twice a year |
| Named references | “Can I speak to a real client?” | Confirm consent every 6 months |
Assurix does part of this for you. It independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. It pulls live evidence from your PSA, RMM and security tools. Live measures such as SLA response, patching and supported operating systems refresh every six hours, other controls on a set cycle, and the result sits on a link a prospect can open. Leave a failure unfixed for 30 days and the Trustmark is suspended publicly. Down to the last two for a 70-user deal, Sereno walked the prospect through its live results and won against a rival holding ISO 27001 and SOC 2. Not the cheapest quote.
How often should evidence be refreshed?
A backup test result from 14 months ago tells a prospect your reporting has stopped. The rule: anything you would put in front of a prospect must be dated within the cadence in the table above. If it is older, it does not go in the deck.
This is where most libraries die. Someone builds a beautiful one in Q1, nobody owns the refresh, and by Q3 the sales team has quietly gone back to talking instead of showing.
What does a good evidence artefact actually look like?
A weak artefact says “we keep backups for all clients.” A strong one is a one-page report dated this month showing each protected system, the last successful restore test, the date it was verified, and an independent source named alongside your own. The prospect does not need to follow the technical detail. They need to see that it is current and that someone other than you stands behind it.
Apply the same standard to every category. “We respond quickly” is a claim. A 12-month chart of first-response times against SLA, with the two months you missed and what you changed, is evidence. The second one wins trust precisely because it admits the misses.
How do you handle a prospect who asks for proof you do not have?
Do not bluff and do not promise a document you cannot produce. Say what you measure, show the nearest current artefact, and commit to a date for the specific one they asked for. A provider who says “I do not have that to hand, I will send it to you verified by Friday” and then does it beats one who waves a vague slide and hopes the question passes. Prospects are testing whether your proof is real or theatre, and the honest answer scores higher than the slick one.
What are the common mistakes when building one?
- Building it once in Q1 and never refreshing it, so it is stale by the time a deal needs it.
- Filling it with claims you wrote rather than evidence a third party could check.
- Bringing the entire library to every meeting instead of the three pages that matter to this prospect.
- Treating certifications as the whole answer when the prospect wants proof the controls are still met today.
- Leaving it without a named owner, so the refresh quietly stops.
WHAT TO DO THIS WEEK
Audit your current sales materials against the six categories above. Count how many items are claims you wrote versus evidence a prospect could independently check. If the ratio is mostly claims, that is your first sprint.
Build the library, map every claim to a current artefact and give the refresh an owner. For the part you can’t verify yourself, Assurix gives you a link a prospect can open.
